Beyond Prompt Injection: The Non-Human Authorization Gap in Enterprise AI

Short summary

The biggest architectural risk in enterprise multi-agent AI is not prompt injection but Delegation Escalation—passing broad bearer tokens down agent chains creates Confused Deputy vulnerabilities. The author recommends OAuth 2.1 Token Exchange (RFC 8693) with nested actor claims, short-lived DPoP-bound tokens, and strict intersection-of-privileges enforcement so agents never exceed the invoking user's permissions. Platform teams must treat AI agents as non-human identities with auditable delegation chains, not static service accounts.

• •Delegation Escalation is a bigger enterprise AI risk than prompt injection
• •OAuth 2.1 Token Exchange with actor claims and DPoP binding is the recommended fix
• •Agent authority must be the strict intersection of user IAM permissions and agent tool scope

Generated with AI, which can make mistakes.